Review the cutover rule changes

Objectives

The address plan is approved. The change owner claims that anything named secure or placed above a deny is safe. Review six proposed changes against the signed policy rather than their names.

Each item is an independent proposal against a baseline that permits established replies, has a guest-to-company deny before public egress, and ends in default deny. Only new staff TCP 443 to .200, management TCP 22 to .200, and guest TCP 443 to public destinations are authorized. Accept only a proposal that preserves these constraints. Service infrastructure is outside this model.

Verdicts are accept or reject. Every rejection needs one reason code from: destination-too-broad | wrong-transport | deny-shadowed | default-open.

NC-1 Add allow staff 10.42.0.0/25 -> 10.42.0.200/32 TCP dst 443 before default deny.
NC-2 Add allow staff 10.42.0.0/25 -> 10.42.0.192/27 TCP dst 443 before default deny; title: secure application.
NC-3 Add allow management 10.42.0.224/28 -> 10.42.0.200/32 TCP dst 22 before default deny.
NC-4 Add allow guests 10.42.0.128/26 -> public destinations only UDP dst 443 after guest-to-company deny; title: secure web.
NC-5 Move guest-to-company deny below the existing guest TCP dst 443 egress allow, and broaden that allow's destination from public-only to any; claim: later deny is more specific.
NC-6 Replace final deny with allow any source -> any destination, any service; title: availability safeguard.

Step-by-step hints

The guided walkthrough, in full. It is free: no XP cost, and it does not touch the paid hint ladder or the reveal gate.

1. Step 1

   Read the request before the artefact

   Treat each proposal as a separate change to the stated baseline. Do not let one rejected proposal contaminate another item's verdict.

2. Step 2

   Judge every line, including the boring ones

   Account for every proposal once, including narrowly scoped entries that need no repair.

   Every line in the fixture carries a verdict

3. Step 3

   Separate what is wrong from what is merely ugly

   Compare source, destination, transport and service with the authorized flows, then simulate ordering where placement changes. Consider what happens to traffic with no earlier match.

   Accept and reject land on the right lines

4. Step 4

   Say why, in the vocabulary the programme uses

   Choose the root failing from the supplied vocabulary. Separate endpoint scope, transport mismatch, ordering bypass and loss of the final restrictive action; accepted proposals carry no rejection reason.

   Each rejection cites a valid reason code

Rules summary

• XP on pass

  60 bonus XP the first time every check goes green.

• Paid hints

  2 available. Each costs 25% of the lab XP (about 15 XP).

• Reveal solution

  Scores 0 XP and unlocks only after 3 check runs.

• Attempt cap

  60 check runs per learner. The runner warns you in the last 10.

• Drafts

  Your editor content is saved in this browser, so a reload will not lose work.

• Walkthrough

  Always free and never penalised: use it before spending a hint.